[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: virtualisation



On 5/23/23 20:35, mick.crane wrote:

root@pumpkin:/home/mick# dd bs=512 count=33 if=/dev/sda skip=468862095 | hexdump -C >dump.txt
33+0 records in
33+0 records out
16896 bytes (17 kB, 16 KiB) copied, 0.0114308 s, 1.5 MB/s
root@pumpkin:/home/mick# nano dump.txt
00000000  d0 80 47 bf 2b 38 99 33  54 ee ec 10 02 26 2a 11 |..G.+8.3T....&*.| 00000010  8b f6 af 00 1e a7 6f 28  22 63 84 18 3b 60 5b fb |......o("c..;`[.|
..........
000041e0  19 d0 6a 27 a9 7e e9 e0  21 24 82 de 64 66 58 41 |..j'.~..!$..dfXA| 000041f0  7d 12 94 8f f4 f3 a0 3a  f1 4a b9 53 fb ac 8d 6e |}......:.J.S...n|
00004200


The sectors are outside the range of partition sda5. In an ideal BIOS-MBR configuration, they should be zeroed. The fact that they are not means something set them, but it has hard to tell from that limited output if those bytes correspond to a secondary GPT partition table, encrypted file system leftovers, or something else.


The first 16 bytes of the secondary GPT header in the last block are the best clue -- they contain an signature, a revision, and a header size:

https://en.wikipedia.org/wiki/GUID_Partition_Table#Partition_table_header_(LBA_1)


My UEFI-GPT machine matches the WikiPedia specification exactly:

2023-05-24 01:09:37 root@taz ~
# dd bs=512 count=1 if=/dev/sda skip=117231407 status=none | hexdump -C | head -n 1 00000000 45 46 49 20 50 41 52 54 00 00 01 00 5c 00 00 00 |EFI PART....\...|


Try this command on your machine:

468862128 - 1 = 468862127

# dd bs=512 count=1 if=/dev/sda skip=468862127 status=none | hexdump -C | head -n 1


David


Reply to: